Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-102503— Missing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM)

Quick assessment

Affected
Google SAM
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Google OSS Agent Mesh (SAM) 在版本 0.1.0-alpha.1 至 0.1.0-alpha.2 中，其 入口服务器（位于 中的 函数）存在关键功能缺失身份验证（CWE-306）和缺失授权（CWE-862）的漏洞。该漏洞允许未经身份验证的远程 libp2p 对等节点绕过 Biscuit 权限策略的强制执行，从而调用任意已注册的后端服务（包括基于命令/标准输入输出的 MCP 服务器、A2A 以及推理端点）。尽管 MCP 协议流处理器执行了 和 检查，但并行的 入口路由却直接将请求转发至后端服

CVSS 9.3 · Critical
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-102503

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Missing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM)
Source: CVE Program / CVE List V5
Vulnerability Description
Missing Authentication for Critical Function (CWE-306) and Missing Authorization (CWE-862) in the /libp2p-http ingress server (StartIngressServer in cmd/sam-node/node.go) in Google OSS Agent Mesh (SAM) versions 0.1.0-alpha.1 through 0.1.0-alpha.2 allow an unauthenticated remote libp2p peer to bypass Biscuit capability policy enforcement and invoke arbitrary registered backend services (including command/stdio-backed MCP servers, A2A, and inference endpoints). While the MCP protocol stream handler enforces WithBiscuitAuth and Authorize checks, the parallel /libp2p-http ingress routes requests directly to backend service handlers without verifying a Biscuit token or mesh enrollment. Users should upgrade to version 0.1.0-alpha.3 or later.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Google SAM 0.1.0-alpha.1 ~ 0.1.0-alpha.3 -

II. Public POCs for CVE-2026-102503

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-102503

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-102503 (1)

Vendor Pages for CVE-2026-102503 (1)

IV. Related Vulnerabilities

Same product: SAM
Same vendor: Google
Same weakness: CWE-306

V. Comments for CVE-2026-102503

No comments yet

Leave a comment